大模型网摘Model Repositories Can Be Poisoned Too: Lessons from the Load/Mine Campaign and a Pre-Download Checklist
At the end of October, security firm Pluto Security published an investigation into a cryptomining and backdoor campaign targeting Hugging Face model repositories, dubbed Load/Mine. Its most notable finding: after the repositories were taken down, the campaign returned within days — the second wave of repositories was still live eight days after being reported.
Event highlights
Researchers traced 31 malicious repositories across 7 Hugging Face accounts. The 19 second-wave repositories recorded more than 29,000 downloads; together with linked models, downloads exceed 32,000. Note that download counts are not infection counts. The targets were concentrated: GPU hosts running self-hosted inference — the report names Xinference and GPUStack — along with rented GPU machines, shared research notebooks, and CI jobs that casually pull small test models.
Why loading a model can execute code
The key is trust_remote_code=True: this flag imports the repository's Python files before any weights load, with the caller's privileges. In other words, malicious logic does not need to hide in the weights — it sits in the modeling code the repo asks you to run. The report also points out the blind spot in scanning: the Hub runs every file through antivirus and partner scanners inspect weight formats, but nothing analyzes the Python the repository tells you to execute.
A checklist before downloading open weights
First, keep trust_remote_code=False as the default; when it is truly needed, read the repo's modeling and preprocessing scripts line by line first, checking for outbound network calls and subprocess launches. Second, verify repository ownership — do the organization name and spelling match the official source? Typosquat accounts are a standard trick, and this campaign was distributed across 7 linked accounts. Third, verify weight files against officially published hashes; unverified weights never go to production. Fourth, give self-hosted inference services (Xinference, GPUStack, etc.) dedicated low-privileged accounts and restrict container egress targets. Fifth, pin internal mirrors in CI and forbid pipelines from pulling random public test models at runtime. Sixth, review GPU hosts for unusual processes and mining-pool domains — the report includes full IOCs for comparison.
Ecosystem note
The open-weight ecosystem's convenience and its risks come from the same place, and a large download count is never a security endorsement. Start selection from official sources via our October open-weight flagship spec comparison, then run the checklist above; if you would rather avoid the self-hosting attack surface entirely, official APIs are the lower-friction route — see the deepseek-flash and deepseek-v4-pro quick reference for model names and terms, and the subscription vs metered API comparison for the cost trade-offs.